Both backdoor attacks and targeted data poisoning attacks rely upon the expressiveness of modern deep networks trained from scratch in order to “gerrymander" the network's decision boundary around specific target images [1]} —\(\text{}\)  they behave normally on validation data and the chosen target is often made into a class outlier that is surgically labeled in an adversarial way using an erratic decision boundary. As a result, one can assume changes in the training procedure, such as strong data augmentation, could have a significant impact on the success of poisoning methods by imposing regularity on the decision boundary and preventing target images from being gerrymandered into the wrong class. Note the sensitivity of poisoning to changes in training has been confirmed by defenses involving gradient clipping/noising, which is the only defense shown in [1]}, [3]} to degrade poisoning success. However, this defense ultimately proves impractical because of the decreased natural accuracy that comes with robustness to poisoning. Thus, we aim to bridge this gap and develop small changes in training via data augmentation that defend against data poisoning without impeding normal training.
